authentication is first (login page is displayed first)